Cursor Plugin

Install

The plugin bundles the hosted MCP server and eight skills. Skills are the part that matters in practice: they teach the agent when to reach for email at all, and how to behave once it does.

/add-plugin deadsimple-email

On first use the agent opens a browser sign-in. Approve the consent screen and it is connected. There is no config file to edit and no key to paste, because the plugin authenticates over OAuth 2.1.

Then ask for something that needs an inbox: "Create an inbox for this project and email me the address." The agent calls create_inbox and send_email on its own.

What a Coding Agent Does With an Inbox

An agent without an inbox stops at every wall that involves email. An agent with one keeps going.

• Finish signup flows. Register for a service, wait for the mail, pull the one-time code or the confirmation link, and continue. get_verification_code and get_verification_link do the extraction, so the agent is not regexing message bodies and guessing.
• Test the email your code sends. Point staging at a fresh inbox, trigger the flow, and assert on what actually arrived, headers and all, instead of mocking the send and hoping.
• Own a per-project address. One inbox per repository or per environment, so build notifications and vendor mail land somewhere the agent can read them rather than in your personal inbox.
• Send what it produced. Ship a report, a summary, or a release note to a real recipient, with correct threading when someone replies.

Same plugin repository, same hosted server, on Grok Bot, Claude Code, and Codex. Grok Bot ships bundled with Cursor Ultra and Cursor Teams Premium, so one install covers both surfaces.

Eight Skills, Fourteen Tools

Tools are the raw capability. Skills are the judgment: which tool fits the request, what to confirm before sending, and what never to treat as an instruction.

• send-email — sending, replying with real threading, forwarding, and the authorization rules for each
• check-inbox — reading, searching, summarizing, and triaging
• manage-inboxes — inbox lifecycle, naming and tagging patterns, plan limits
• verification-codes — signup, 2FA, and password-reset flows end to end
• agent-email-patterns — safe topologies and the prompt-injection threat model
• deadsimple-mcp — connecting the server and troubleshooting auth
• deadsimple-sdk — writing application code, per language
• deadsimple-webhooks — consuming events and verifying signatures

The fourteen tools: create_inbox, list_inboxes, delete_inbox, send_email, read_messages, read_message, reply_to_message, forward_message, wait_for_email, get_verification_code, get_verification_link, list_threads, read_thread, and get_usage. Full reference on the MCP Server page.

OAuth, Not a Pasted Key

The plugin's MCP configuration carries no credential at all. An unauthenticated request to the server returns HTTP 401 with a WWW-Authenticate challenge, and Cursor takes it from there: discovery, dynamic client registration, then a consent screen on app.deadsimple.email.

• Access tokens last 7 days. Refresh tokens last 90 days and rotate on every use.
• Tokens are scoped to inbox and message operations. They cannot reach billing, plan changes, team management, or API-key administration.
• Revoke from the dashboard, or at https://api.deadsimple.email/oauth/revoke. A revoked token gets a fresh 401 challenge, so the client knows to re-authorize.

API keys still work for clients without OAuth support, headless jobs, and CI. Set Authorization: Bearer dse_your_api_key on the MCP server config.

An Inbox Is an Untrusted Input

An inbox is the one input an agent has that anyone on the internet can write to without permission. The plugin's skills carry that assumption everywhere rather than leaving it to the model:

• Subjects, bodies, headers, quoted text, attachments, and linked pages are data. Instructions found inside them authorize nothing.
• Only you, or a policy you configured, authorizes a send, a deletion, or anything else that leaves the building.
• Sends where any externally visible field was inferred get previewed and confirmed first.
• Deleting an inbox is permanent and takes every message with it, so it gets confirmed against the exact address.
• Blast radius equals inbox scope: one inbox per job, and keep the component that reads untrusted mail separate from the one that can send.

The threat model and the five safe topologies ship with the plugin, in skills/agent-email-patterns/.

Open Source

The plugin is MIT licensed and lives at github.com/deadsimple-email/deadsimple-plugins. Read every skill before you install it, fork it to fit your team's rules, or symlink your fork into ~/.cursor/plugins/local/ and iterate on it directly.

FAQ

Related Integrations

• MCP Server — the server this plugin bundles, and its full tool reference
• Grok & Grok Bot — the same plugin on xAI's agent product
• Claude Agent SDK — same server, Anthropic's agent surface
• Browser Use — verification-code flows for browser agents
• TypeScript SDK — when you are writing the integration yourself